About the Author
Atul Kahate has 12 years of experience in information Technology in india and
Aabroad in various capacities. He has done his Bachelor of Science degree in
Statistics and his Master of Business Administration in Computer Systems. He
has authored thirteen highly acclaimed books published by Tata McGraw-Hill
'as. and Pearson Education on various areas of information Technology (including
\ ) editions), titled Web Technologies -- TCP/IP to internet APPlication
Architec"' tures, Fundamentals Of Computers, Information Technology and Numerical
Methods, FOundations of information Technology, OPerating Systems and
Systems Programming, OPerating Systems, Computer Communication Networks,
Introduction to Database Management Systems, Object Oriented Analysis and Design, and Schaum's
Series Outlines--Programming in C+ +. Two of these are published as international editions worldwide
by McGraw-Hill and have also been translated into Chinese. Several of his books are being used as
course textbooks or sources of reference in a number of universities/colleges/IT companies all over the
world.
Kahate has been writing articles in newspapers about cricket since the age of 12 and has also authored
two books on cricket. He has written over 1000 articles on iT and cricket in all the leading newspapers
and magazines/journals in india and abroad. He has deep interest in teaching, music and cricket, besides
technology. He has conducted several training programmes in a number of educational institutions and
IT organizations, including prestigious institlltions such as lIT, Symbiosis, I'IT, MET, Indira institute of
Management, Fergusson College, MIT, VllT, MIT, Walchand Government Engineering College, etc.,
and numerous other colleges in india, on a wide range of technologies.
He has also worked as the official cricket statistician and scorer in a number of Test and Licited
Overs international cricket matches. He has a rich collection of books on iT and cricket, and has
developed his own database that can provide the latest cricket statistics at any moment. He has
contributed to cricket websites, such as CriclnfO and Cricket Archive. He is a member of the Association
of Cricket Statisticians, England, and has written several articles for the Association of Cricket
Statisticians and Scorers of india.
Kahate has won several awards, both in india and abroad. He has worked with Syntel, L&T Infotech,
American Express and Deutsche Bank previously and is working with i--flex solutions limited as Project
Manager for about six years now. He lives in Pune with his wife Anita, daughter Jut and son Harsh. He
can be reached at akahate@gmail.com.
To,
My wife AnitU for her love. sunnort. and patience
y wife AnitUfor her love, suPPort, andpatience
My daughter Jut for making every day the most beautiful day of my life
J .nterjuifor making every day the most beautiful day of my life
My son Harsh for being the nauqhtiest person at our home
d i or Lne naughtiestperson at our home
Preface to the Second Edition
Having worked in the area of information Technology for about six years (in 2001 ), I had read a lot about
o worked in the area of information Technology for about six years (in 2001), I had read a lot about
information securitV, and how to achieve it. However, my concepts were vague, and I knew the
J, and how to achieve it. However, my concepts were vague, and I knew the
technology of security in bits and pieces. This was quite annoying, as it never gave a feeling of
ioJ J in bits and pieces. This was quite annoying, as it never gave a feeling of
satisfaction. It was as if I did not know the complete pictllre. For example, I did know that number
systems played an important role in cryptography, but did not know how much I should know about
them to understand the concepts thoroughly. Similarly, I knew that digital certificates and Public Key
Infrastructure (PKI) were quite wonderful technologies, but knew only to some extent as to how they
worked. Numerous other examples can be given.
Then I got an opportunity to lead an information security project in i-flex solutions limited. I knew
o pportunity to lead an information security project in i-flex solutions limited. I knew
that I could learn a lot simply by working on that project. However, I also felt very strongly that until I
was thorouZh with all the aSDects of comDUter securitV/crVptoZraDhv myself. I would not be able to do
o poets of computer security/cryptography myself, I would not be able to do
..
true lustice to this project. It was for this reason that I took up the task of studying each and every aspect
J ustice to this project. It was for this reason that I took up the task of studying each and every aspect
of these technologies. Unfortllnately, there were a lot of hurdles. The main hurdle was that there was not
o j, Lllere were a lot of hurdles. The main hurdle was that there was not
. 1, 1, 1., 1 1
a single book that explained all that I wanted, and more importantly, in the manner that I wanted. My
.ie book that explained all that I wanted, and more importantly, in the manner that I wanted. My
colleagues in the protect also exDressed this feeling on many occasions. The information available was
to i sect also expressed this feeling on many occasions. The information available was
scattered, quite complex to understand, and not explained to the level that makes one completely
understand what is going on.
o o
The struggle for learning was quite wonderful! However, it also convinced me that I should make an
orer o 1,
-.
attempt to explain what I know, in a very simple manner, so that others who ventllre into this area do not
have to struggle the way I did. This is perhaps the main intention behind this book. In simple terms, it is
..ie the way I did. This is perhaps the main intention behind this book. In simple terms, it is
something, which makes me feel, 'if only such a book were available when I started exploring and
to d ploring and
learning about security/cryptography'. The biggest satisfaction will be if and when readers in similar
b about security/cryptography'. The biggest satisfaction will be if and when readers in similar
..
situations, feel contented after reading this book.
The first edition of this book was published in early 2003. At that time, there were very few books on
the subject, and the ones that existed were quite complex to comprehend. Hence, I had made a genuine
J, i plex to comprehend. Hence, I had made a genuine
. -.
attempt to simplify the subject to the maximum possible extent. I had not written the book with any
specific aims of addressing the needs of some syllabi. I had written it in a manner that I felt made
understanding the sublect verV easV, more than anything else. To my surprise, in the last four and half
o J J easy, more than anything else. To my surprise, in the last four and half
years, not only has the book been used in almost all syllabi in india and many other countries, but in
addition, several syllabi/courses have been designed around this book. This has reinforced my belief that
the sequencing and structuring of the contents of the book is largely correct. This belief has been
. 1, 1,, n, n.
graciously greeted by the readers of the first edition of the book, which has seen & reprints, an
.. -,..
international edition, and a Chinese translation, too!
xii Preface to the Second Edition
At the same time, security technology is moving rapidly to say the least; and four and half years is a
very long time for revising the contents of the book. Several new technologies have emerged, new
versions of existing technologies/Protocols have been developed; and we must constantly look at these
areas for incorporation in this book. Some of the major areas in this context are as follows
. More detailed coverage of modern algorithms such as AES, SHA-256 and its variations, TLS, etc.
. Providing more mathematical base, wherever needed
. Expanding existing content wherever necessary
. Coverage of some of the topics mentioned in a few syllabi that were not a part of the original
edition
With these changes, I am confident that the book is even better than the first edition in terms of
meeting the reader's expectations.
The major changes are to make the contents more comprehensive, make them up-to-date wherever
necessary, and try to simplify the coverage even further.
These changes are done to address the needs of various syllabi and the feedback received from
hundreds of students, readers, professors, and iT professionals.
This book is targeted at two sets of readers f un dergradu ate/gradu ate/p o s t- gr adn ate s in dent s an d iT
professionals. TO satisfy the diverse needs of both these categories, the book is designed very carefully.
On one hand, it goes into the depth of every aspect, to satisfy the needs of the students, and on the other,
it touches upon the aspects that the iT professionals like to know at a conceptllal level.
A lot of care has been taken in organizing and sequencing the topics. As such, I would recommend
that the reader does not skip any chapters altogether. Howevef, for readers who are keener on getting a
gist of the material without having to understand the whole thing in very minute details, the
mathematical aspects can be skipped.
Students and teachers of the information security/cryptography courses would find the book very
helpful. It discusses the technology in great detail, and there are over 425 diagrams which the teachers
can use in classroom discussions. Each chapter contains;
. Summary of salient points
. List of terms and concepts
. Self-assessment questions - Multiple-Choice Questions (MCQ) and Detailed Questions
. Designlprogramming Exercises
An attempt has been made to keep the presentation style lucid and the language simple.
The overall organization of the book is as follows
Chapter I introduces the basic concepts of security. It discusses the need for security, the principles of
security and the various types of attacks on computer systems and networks. We discuss both the
theoretical concepts behind all these aspects, as well as the practical issues and examples of each one of
them. This will cement our understanding of security. Without understanding why security is required,
and what is under threat, there is no point in trying to understand how to make computer systems and
networks secure. Changesfrom thefirst edition.. A new section on the modern nature of security attacks
is added. Discussions of if "sted systems, security models, security management practices, and ethical/
legal issues are added. A new section describes the types of attacks. New attacks such as phishing and
pharming are covered.
Chapter 2 introduces the concept of cryptography, which is the fundamental building block of
computer security. Cryptography is achieved by using various algorithms. All these algorithms are based
Preface to the Second Edition xiii
on either substitution of plain text with some cipher text, or by using certain tfansposition techniques, or
a combination of both. The chapter then introduces the important terms of encryption and decryption.
Changes from the first edition.. Playfair Cipher and Hill Cipher are covered in detail. Diffie--Hellman
Key Exchange coverage is expanded. Types of attacks are covered in detail.
Chapter 3 discusses the various issues involved in computer--based symmetric key cryptography. We
discuss stream and block cipher and the various chaining modes. We also discuss the chief symmetric
key cryptographic algorithms in great detail, such as DES, IDEA, RCS and Blowfish. Changesfrom the
first edition.. The Blowfish algorithm is covered in more detail. AES is significantly expanded.
Chapter 4 examines the concepts, issues and trends in asymmetric key cryptography. We go through
the history of asymmetric key cryptography. Later, we discuss the major asymmetric key cryptographic
algorithms, such as RSA, MDS, SHA, and HMAC. We intfoduce several key terms, such as message
digests and digital signatures in this chapter. We also study how best we can combine symmetric key
cryptography with asymmetric key cryptography. Changesfrom thefirst edition: Variations of the
SHAl message digest algorithm are covered, with specific coverage of SHA-sl2.
Chapter 5 talks about the upcoming popular technology of Public Key infrastrUcture (PKI). Here, we
discuss what do we mean by digital certificates, how they can be created, distributed, maintained and
used. We discuss the role of Certification Authorities (CA) and Registration Authorities (RA). We also
introduce the Public Key Cryptography Standards (PKCS). Changes from thefirst edition: Covers the
details of creating digital certificates in Java..
Chapter 6 deals with the important security protocols for the internet. These protocols include SSL,
SHTTP, TSP, SET and 3D-Secure. We also discuss how electronic money works, what are the dangers
involved therein and how best we can make use of it. An extensive coverage of email security is
provided, with a detailed discussion of the key email security protocols, such as PGP, PEM and S/
MIME. We also discuss wireless security here. Changesfrom thefirst edition: The coverage of SSL is
expanded, and it is compared with TLS. Coverage of PGP is expanded to explain key rings, PGP
certificates, and tfust management.
Chapter 7 tells us how to authenticate a user. There are various ways to do this. The chapter examines
each one of them in significantly great detail and addresses their pros and cons. We discuss
passwordbased authentication, authentication based on something derived from the password, authentication
tokens, certificate-based authentication, and biometrics. We also study the popular Kerberos protocol.
Changes from the first edition.. Covers the concepts of security handshakes. It then covers one--way
authentication and mutual authentication in detail.
Chapter & deals with the practical issues involved in cryptography. Currently, the three main ways to
achieve this is to use the cryptographic mechanisms provided by Sun (in the Java programming
language), Microsoft and third-party toolkits. We discuss each of these approaches. Changesfrom the
first edition.. The practical aspects of cryptography in Microsoft's .NET framework are also covered
now. The aspects of operating systems security have been enhanced. Database security is covered in
detail.
Chapter 9 is concerned with network layer security. Here, we examine firewalls, their types and
configurations. Then we go on to lP security, and conclude our discussion with Virtual Private Networks
(VPN). Changesfrom thefirst edition.. Network Address Translation (NAT) is added. The concepts of
intfusion and intrusion detection are covered in detail.
Chapter 10 contains a number of case studies in the area of cryptography and network security. It
discusses how the concepts learnt in the earlier chapters can be put into actual practice. It also covers a
xiv Preface to the Second Edition
few real-life security attacks that have happened, and how they have been dealt with. This presents the
viewpoints of the attackers as well as those of the attacked party. Changes from the first edition.. A
couple of more case studies are added.
An Online Learning Center provides online content for the benefit of students and instrUctors alike.
This will contain solutions to all exercises, sample question papers, additional programming exercises,
web links, Powerpoint Slides, Cryptography Demos with AES and DES Applets, and real-life case
studies. The contents of this website will be updated from time to time.
Without a doubt, Mr. Achyut Godbole has had the greatest influence on my life. I have learnt so much
from him in so many ways, both personally and technically. He continues to provide constant
encouragement, honest feedback and words of motivation. I cannot express my gratitude for him in
words.
My parents and the whole family have been very understanding and supportive. I wish to thank them
all besides all my great friends. Besides putting up with the household difficulties, my wife Anita has
actually helped me with a number of reviews, which carry a lot of meaning, as she has been a software
professional herself. Her sacrifices always allow me to use my spare time constrUctively. My little and
wonderful daughter Jut and very naughty son Harsh have woken up and watched me curiously working
on my laptop at 4 a.m. on many occasions. They have made me laugh even when the chips were
sometimes down.
This book would not have been possible without the help and support of a number of individuals. My
six years in my current organization (i-flex) have been made immensely memorable by people right from
the top (Mr Rajesh Hukku, Mr Deepak Ghaisas, Mr Nandu Kulkarni, Mr N K Raman, Mr V Shankar, Mr
Vivek Govilkar)to right up to the newest joined in the organization. I am very grateful for all their
support, encouragement and words of wisdom. I cannot thank all my dear student friends enough, who
always keep me motivated to learn something new. I would like to thank Bruce Schneier, Dan Conway
and David ireland for some of the programming exercises.
Hundreds of readers all over the world have sent such memorable emails about the first edition of the
book that it actually makes all this effort seem nothing! I thank all of them profusely for taking their
valuable time to appreciate something they have found a bit useful.
As ever, the team at McGraw--Hill (MGH) has been simply brilliant. This book would not have seen
the light of day without the expertise and enthusiasm of Vibha Mahajan, Nilanjan Chakiavarty, and the
rest of the team. I would like to express my gratitude to all of them.
I am grateful to the following reviewers for providing valuable suggestions for the improvement of
this book..
Dr. V.S. Janakiramall, SG College of Arts and Sciences, Coimbatore, Ms. V. Valli Kumari, Andhra
University, Vishakhapatnam, Pro f Jaydip Sen, Future institute of Engineering and Management,
Kolkata, and ProL Bhushan H Trivedi, GLS Institute of Computer Technology, Bangalore. Pro f. L.K.
Suresh Kumar, Osmania University, Mr. Dilip Kumar, National institute of Technology, Jamshedpur.
I would be very happy to hear from you at akahate@gmail.com.
ATUL KA~E
Preface to the First Edition
Background
.round
" al 1 1 I.. c H
Three pooDle can keep a secret only if two of them are dead!"
people can keep a secret only if two of them are dead!"
-- Beniamin Franklin
Jamin Fmnklin
Quotes such as these are quite common. Keeping secrets is not easy. In fact, human tendency is such that
when told that something is a secret and asked to keep it secret. DeODle are actually auite eager to share that
o i> a secret and asked to keep it secret, people are actually quite eager to share that
secret with everVone else! It is often said that to make something public, it should be called a secret, and told
j o public, it should be called a secret, and told
.. -,
it in a verV hush--hush manner to as many people as possible. The word of mouth will automatically spread it!
J nush--hush manner to as many people as possible. The word of mouth will automatically spread it!
In the early days of serious comDuting (1950s--60s), there was not a great deal of emphasis on security,
j J puting (1950s--60s), there was not a great deal of emphasis on security,
because the systems in those days were DroDrietarV or closed. In simile terms, although computers exchanged
J j > were proprietary or closed. In simple terms, although computers exchanged
data and information with each other, they formed a part of a network that was completely under the control
of an organization. The protocols used for computer--to--computer communication in those days were also not
.anization. The protocols used for computer--to--computer communication in those days were also not
known to the general public. Therefore, the chances of someone getting an access to the information being
o public. Therefore, the chances of someone getting an access to the information being
exchanged were not very high. That was also the reason why information security was not a major issue in
o J nigh. That was also the reason why information security was not a major issue in
those days.
j O.
As the minicomputers and microcomputers evolved in the 1970s and 1980s, the issue of information
. -..
security started to gain more prominence. However, it was still not an item of the highest priority on the
J >tarted to gain more prominence. However, it was still not an item of the highest priority on the
agenda of the managers and technologists. People used to treat information security as one of the objectives of
a hardware/software system. This continued well into the early 1990s. However. it was the internet, which
J J i990s. However, it was the internet, which
changed the whole computing paradigm, and brought a tremendous change in the way computers
o puting paradigm, and brought a tremendous change in the way computers
. -.
communicated with each other. The world of computers had suddenly become very open. Proprietary
protocols (such as IBM's SNA) were no longer popular. It was the open standard of TCP/IP, which was the
glue between the computers scattered around the world.
The stupendous growth of the internet opened up unlimited opportunities for computing. However, at the
..
same time, it also brought about a plethora of new issues and concerns, chief among them being the security
of information being exchanged. For example, some of the possibilities were f
o o pie, some of the possibilities were f
. It was no longer safe to send your credit cards details over the network (Internet) to another computer.
o J our credit cards details over the network (Internet) to another computer.
. A person accessing the connection between the sender and the recipient could read the e--mails being
exchanged.
o
. People would try to login with someone else's credentials, and use the privileges of that person.
Now, there were so many new threats and possible attacks on information. As the technologists found new
waVs to thwart these attacks, the attackers found new ways to beat the technologists. This continues even now,
J a to thwart these attacks, the attackers found new ways to beat the technologists. This continues even now,
and in all probability, it will continue to happen in the future. Therefore, it is very important to know how we
can make information exchange secure.
u
xvi Preface to the first Edition
Motivation
Having worked in the area of information Technology for about & years, I had read a lot about information
security, and how to achieve it. However, my concepts were vague, and I knew the technology of security in
bits and pieces. This was quite annoying, as it never gave a feeling of satisfaction. It was as if I did not know
the complete picture. For example, I did know that number systems played an important role in cryptography,
but did not know how much I should know about them to understand the concepts thoroughly. Similarly, I
knew that digital certificates and Public Key infrastructure (PKI) were quite wonderful technologies, but
knew only to some extent as to how they worked. Numerous other examples can be given.
Then I got an opportunity to lead a PKI project. I knew that I could learn a lot simply by working on that
project. However, I also felt very strongly that until I was thorough with all the aspects of computer security/
cryptography myself, I would not be able to do true justice to this project. It was for this reason that I took up
the task of studying each and every aspect of these technologies. Unfortunately, there were a lot of hurdles.
The main hurdle was that there was not a single book, which explained all that I wanted, and more
importantly, in the manner that I wanted. My colleagues in the project also expressed this feeling on many
occasions. The information available was scattered, was quite complex to understand, and was not explained
to the level that makes one completely understand what is going on. I had to strUggle a lot to understand how
it all works.
The struggle for learning was quite wonderful! However, it also convinced me that I should make an
attempt to explain what I know, in a very simple mannef, so that others who venture into this area do not have
to struggle the way I did. This is perhaps the main intention behind this book. In simple terms, it is something,
which makes me feel, 'if only such a book were available when I started exploring and learning about
security/cryptography'. The biggest satisfaction will be if and when readers in similar situations, who have
the same feeling, feel contented after reading this book.
Intended Audience
This book is targeted at two sets of readers; IT professionals and undergraduate/graduate/Post--gra
students. To satisfy the diverse needs of both of these categories, the book is designed very carefully. On one
hand, it touches upon the aspects that the iT professionals like to know (conceptual level), and it also goes into
the depth of every aspect, to satisfy the needs of the stlldents.
Organization
Teachers teaching information security/cryptography courses would find the book very helpful. It discusses
the technology in great detail, and there are over 400 diagrams, which the teachers can use in classroom
discussions. Each chapter contains the summary of salient points and a list of terms and concepts. To help the
reader to check the understanding of the concepts, each chapter concludes with self--assessment questions.
There are Multiple Choice Questions (MCQ), Review Questions, and a unique section on Design/
Programming Exercises. This provides the reader with sufficient hands--on opportunities.
An attempt has been made to keep the presentation style lucid and the language simple.
An online learning centre is set up for the teachers, where they can find answers to the chapter--end Review
Questions and solutions to the Design/Programming Exercises. This site also contains important diagrams
from the book as Powerpoint slides (with appropriate notes), which can be directly used for classroom
discussions or presentations.
The chapter--wise organization of the book is explained at the end of the first chapter.
FeedbacklComments
You are welcome to write to me at akahate@illdiatimes.com with your suggestions or comments about this
book. Your feedback would help in making this book better when we revise it for the next edition.
ATUL KAHArE
Important Terms and Abbreviations
portant Terms and Abbreviations
I-factor authentication Authentication mechanism, which involves the party to be authenticated
concerned with only one factor (e.g., know something).
j, o., Kflow something).
2-factor authentication Authentication mechanism, which involves the party to be authenticated
concerned with two factors (e.g., know something and have something).
3-D Secure PaVment mechanism developed bV Visa for Web--based transactions.
J Inent mechanism developed by Visa for Web--based transactions.
Acauirer Bank/financial institution that facilitates a merchant to acceDt and Drocess credit card Dayments.
quirer Bank/financial institution that facilitates a merchant to accept and process credit card payments.
Active attack Form of attack on security where the attacker makes attemDts to change the contents of the
J pts to change the contents of the
message.
o
ActiveX control Small client--side program that gets downloaded along with a Web page, and executes
..,,, ml.., x. n, 1 4.
inside the browser. This is a Microsoft technology. ActiveX controls are somewhat similar to Java applets.
.y. ActiveX contfols are somewhat similar to Java applets.
Algorithm mode Defines the details of a cryptographic algorithm.
Algorithm type Defines how much plain text should be encrypted/decrypted at a time.
APPlication gateway Type of firewall that filters packets at the application layer of TCP/IP stack. Same as
Bastion host or Proxy server.
d
Asymmetric Key Cryptography Cryptographic technique where a key pair is used for encryption and
decrVption ODerations.
j ption operations.
Authentication Principle of security, which identifies a user or a computer system, so that it can be trusted.
Authentication token Small piece of hardware used in 2--factor authentication mechanisms.
Authority Revocation List (ARL) List of revoked Certification Authorities (CA).
y Revocation List (ARL) List of revoked Certification Authorities (CA).
Availability Principle of security, which ensures that a resource/computer system is available to the
-
authorized users.
Bastion host TVpe of firewall that filters Dackets at the application laver of TCP/IP stack. Same as
ape of firewall that filters packets at the application layer of TCP/IP stack. Same as
APPlication gateway or Proxy server.
Behaviounblocking software Software that integrates with the operating system of the computer and keeps
a watch on virus--like behavior in real time.
Bell-Lapadula model a highly trustworthy computer system is designed as a collection of objects and
.ifly trustworthy computer system is designed as a collection of objects and
subjects. Objects are passive repositories or destinations for data, such as files, disks, printers, etc. Subjects
,cots. Objects are passive repositories or destinations for data, such as files, disks, printers, etc. Subjects
...
are active entities, such as users, processes, or threads operating on behalf of those users.
Biometfic authentication Authentication mechanism that depends on the biological characteristics of a
user.
Block cinher EncrVpts/decrVpts a group of characters at a time.
pher Encrypts/decrypts a group of characters at a time.
Bucket brigade attack A form of attack in which the attacker intercepts the communication between two
.
parties, and fools them to believe that they are communicating with each othef, whereas they actually
..
communicate with the attacker. Same as man-in-the-middle attack.
Book Cinher CrVptographic technique involving the key selected randomly from a page in a book.
pher Cryptographic technique involving the key selected randomly from a page in a book.
xviii Important Terms and Abbreviations
Brute-force attack Form of attack wherein the attacker tries all possible combinations of the key one after
the other in quick succession.
Caesar Cipher Cryptographic technique wherein each plain text character is replaced with an alphabet
three places down the line.
Cardholder Customer, who shops online on the Web, and makes payments for the same using a credit/debit
card.
Certificate directory Pre--specified area containing the list of digital certificates.
Certificate Management Protocol (CMP) Protocol used in the requesting of a digital certificate.
Certificate Revocation List (CRL) List of revoked digital certificates. It is an off line certificate checking
mechanism.
Certificate Signing Request (CSR) Format used by a user to request for a digital certificate from a CA/RA.
Certificate-based authentication Authentication mechanism wherein the user needs to produce her digital
certificate, and also has to provide a proof of possessing that certificate.
Certification Authority (CA) Authority that can issue digital certificates to users after proper authentication
checks.
Certification Authority hierarchy Hierarchy that allows multiple CAs to operate, thereby taking load off a
single CA.
Chain of ti'Ust Mechanism whereby a trust is established from the current CA up to the root CA.
Chaining mode Technique of adding complexity to the cipher text, making it harder to crack.
Challenge/response token Type of authentication token.
Chosen cipher text attack Type of attack where the attacker knows the cipher text to be decrypted, the
encryption algorithm that was used to produce this cipher text, and the corresponding plain text block. The
attacker's job is to discover the key used for encryption.
Chosen plain text attack Here, the attacker selects a plain text block, and tries to look for the encryption of
the same in the cipher text. Here, the attacker is able to choose the messages to encrypt. Based on this, the
attacker intentionally picks patterns of cipher text that result in obtaining more information about the key.
Chosen text attack This is essentially a combination of chosen plain text attack and chosen cipher text
attack.
Cipher Block Chaining (CBC) Mechanism of chaining.
Cipher Feedback (CFB) Mechanism of chaining.
Cipher tact Result of encryption on a plain text message.
Cipher text only attack in this type of attack, the attacker does not have any clue about the plain text. She
has some or all of the cipher text.
Circuit gateway Form of application gateway, which creates a connection between itself and the remote
host/server.
Clear tact Message in an understandable/readable form, same as Plain text.
Collision if two messages yield the same message digest, there is a collision.
Confidentiality Principle of security, which ensurres that only the sender and the recipient of a message
come to know about the contents of that message.
Confusion Performing substitution during encryption.
Counter (mode) In this algorithm mode, a counter and plain text block are encrypted together, after which
the counter is incremented.
Cross-eel'tification Technology wherein CAs from different domains/locations sign each other's
certificates, for ease of operation.
Cryptanalysis Process of analyzing cipher text.
Cryptanalyst Person who performs cryptanalysis.
Cryptographic toolkit Software that provides cryptographic algorithms/operations for use in applications.
Important Terms and Abbreviations xix
Cryptography Art of codifying messages, so that they become unreadable.
Cmptology Combination of cryptography and cryptanalysis.
Data Encryption Standard (DES) IBM's popular algorithm for symmetric key encryption, uses 56--bit
keys, not used widely of late.
Decryption Process of tfansforming cipher text back into plain text -- opposite of Encmption.
Demilitarized Zone (DMZ) Firewall configuration that allows an organization to securely host its public
servers and also protect its internal network at the same time.
Denial Of Service (DOS) attack An attempt by an attacker to disallow authorized users from accessing a
resource/computer system.
Dictionary attack Attack wherein the attacker tries all the possible words from the dictionary (e.g. as a
password).
Deferential cryptUnalysis Method of cryptanalysis that looks at pairs of cipher text whose plain texts have
particular differences.
Diffusion Performing transposition during encryption.
Digital cash Computer file representing the equivalent of real cash. Bank debits the user's real bank
account and issues digital cash, instead. Same as electronic cash.
DigitUI eel'tlficat6 Computer file similar to a paper-based passport, links a user to a particular public key,
and also provides other information about the user.
Digital envelope Technique wherein the original message is encrypted with a one--time session key, which
itself is encrypted with the intended recipient's public key.
Digital Signature Algorithm (DSA) Asymmetric key algorithm for performing digital signatures.
Digital Signature Standard (DSS) Standard specifing how digital signature should be done.
DNS spoofing See Pharming.
Double DES Modified version of DES, involves 128-bit keys.
Dual signature Mechanism used in the Secure Electronic Transaction (SET) protocol whereby the payment
details are hidden from the merchant, and the purchase details are hidden from the payment gateway.
Dynamic packetfilter Type of packet filter, which keeps learning from the current status of the network.
Electl'Onic cash Computer file representing the equivalent of real cash. Bank debits the user's real bank
account and issues digital cash, instead. Same as digital cash.
Electronic Code Book (ECB) Mechanism of chaining.
Electl'Onic money See Electronic cash.
Encryption Process of transforming plain text into cipher text - opposite of Decryption.
Fabrication False message created by an attacker to distort the attention of the authorized users.
Firewall Special type of router, which can perform security checks and allows rule--based filtering.
Hash Fingerprint of a message, same as Message digest. Identifies a message uniquely.
Hill Cipher Hill cipher works on multiple letters at the same time. Hence, it is a type of polygraphic
substitution cipher.
HMAC Similar to a message digest, HMAC also involves encryption.
Homophonic Substitution Cipher Technique of encryption in which one plain text character is replaced
with one cipher text character, at a time. The cipher text character is not fixed.
Integrity Principle of security, which specifies that the contents of a message must not be altered during its
transmission from the sender to the receiver.
Interception Process of an attacker getting hold of a message in transit, before it reaches the intended recipient.
International Data Encryption Algorithm (IDEA) International Data Encryption Algorithm (IDEA) -- a
symmetric key encryption algorithm, developed in 1990's.
Internet Security Association and Key Management Protocol (ISAKMP) Protocol used in IPSec for key
management. Also called as Oakley.
xx Important Terms and Abbreviations
Interruption Attacker creating a situation where the availability of a system is in danger. Same as
Masquerade.
lP Security (IPSec) Protocol to encrypt messages at the network layer.
Issuer Bank/financial institution that facilitates a cardholder to make credit card payments on the internet.
Java aPPlet Small client--side program that gets downloaded along with a Web page, and executes inside the
browser. This is a Sun technology. Java applets are somewhat similar to ActiveX contfols.
Java Cryptography Architecture (JCA) Java's cryptography mechanism, in the form of APIs.
Java Cryptography Extensions (JCE) Java's cryptography mechanism, in the form of APIs.
Kerberos Single Sign On (SSO) mechanism, that allows a user to have a single user id and password to
access multiple resources/systems.
Key The secret information in a cryptographic operation.
Key Distribution Center (KDC) A central authorics dealing with keys for individual computers (nodes) in
a computer network.
Key wraPPing See Digital envelope.
Known plaintext attack in this case, the attacker knows about some pairs of plain text and corresponding
cipher text for those pairs. Using this information, the attacker tries to find other pairs, and therefore, know
more and more of the plain text.
Lightweight Directory Access Protocol (LDAP) Protocol that allows easy storage and retrieval of
information at/from a central place.
Linear cryptonalysis An attack based on linear approximations.
Luclfer One symmetric key encryption algorithm.
Man-in-the-middle attack A form of attack in which the attacker intercepts the communication between
two parties, and fools them to believe that they are communicating with each other, whereas they actually
communicate with the attacker. Same as bucket brigade attack.
Masquerade Attacker creating a situation where the availability of a system is in danger. Same as
Interruption.
MDS Message digest algorithm, now seems vulnerable to attacks.
Merchant Person/organization, who sets up an online shopping site, and accepts electfonic payments.
Message Authentication Code (MA C) See HMAC.
Message digest Fingerprint of a message, same as Hash. Identifies a message uniquely.
Microsoft Cryptography APPlication Programming interface (MS-CAPI) Microsoft's cryptography
mechanism, in the form of APIs.
Modification Attack on a message where its contents are changed.
Mono-alphabetic Cipher Technique of encryption in which one plain text character is replaced with one
cipher text charactef, at a time.
Multi-factor authentication Authentication mechanism, which involves the party to be authenticated
concerned with multiple factors (e.g. know something, be something and have something).
Mutual authentication in mutllal authentication, A and B both authenticate each other.
Network level attack Security attacks attempted at the network/hardware level.
Non-repudiation Provision whereby the sender of a message cannot refuse having sent it, later on, in the
case of a dispute.
One-Time Pad Considered very secure, this method involves the usage of a key, which is used only once
and then discarded forever.
One-time password Technology that authenticates user based on passwords that are generated dynamically,
used once, and then destroyed.
One-way authentication in this scheme, if there are two users A and B, B authenticates A, but A does not
authenticate B.
Important Terms and Abbreviations xxi
Online Certificate Status Protocol (OCSP) Online protocol to check the status of a digital certificate.
Output Feedback (OFB) Mode of chaining.
Packetfilter Firewall that filters individual packets based on rules. WOrks at the network layer.
Passive attack Form of attack on security where the attacker does not make an attempt to change the
contents of the message.
Password Authentication mechanism that requires a user to enter a secret piece of information (i.e. the
password) when challenged.
Passwordpolicy Statement outlining the structure, rules and mechanisms of passwords, in an organization.
Pharming Modifying the Domain Name System (DNS) so as to direct genuine URLs to false lP addresses
of attackers.
Phishing Technique used by attackers to fool innocent users into providing confidential/personal
information.
Plain text Message in an understandable/readable form, same as Clear text.
Playfair Cipher A cryptographic technique that is used for manual encryption of data. This scheme was
invented by Charles Wheatstone in 1854.
Polygram SubstitUtion Cipher Technique of encryption where one block of plain text is replaced with
another, at a time.
Pretty Good Privacy (PGP) Protocol for secure email communications, developed by Phil Zimmerman.
Privacy Enhanced Mail (PEM) Protocol for secure email communications, developed by internet
Architecture Board (lAB).
Proof Of possession (POP) Establishing the proof that a user possesses the private key corresponding to
the public key, as specified in the user's digital certificate.
Proxy server Type of firewall that filters packets at the application layer of TCP/IP stack. Same as
APPlication gateway or Bastion host.
PseudocoUision Specific case of collision in the MDS algorithm.
Psuedo-random number Random number generated using computers.
Public Key Cryptography Standards (PKCS) Standards developed by RSA Security inc for the Public Key
Infrastructure (PKI) technology.
Public Key infrastructure (PKI) Technology for implementing ansymmetric key cryptography, with the
help of message digests, digital signatures, encryption and digital certificates.
Public Key infrastl'ucture X.509 (PKIX) Model to implement PKI.
Rail Fence Technique Example of transposition technique.
RCS Symmetric key block encryption algorithm, involving variable length keys.
Reference monitor Central entity, which is responsible for all the decisions related to access control of
computer systems.
Registration Authority (RA) Agency that takes some of the jobs of a Certification Authority (CA) on itself,
and helps the CA in many ways.
Replay attack Form of attack wherein an attacker gets hold of a legal message, and attempts a
retfansmission of the same at a later point of time.
Replay attack Attack on a system wherein the attacker gets hold of a message, and attempts to re-send it,
hoping that the receiver does not detect this as a message sent twice.
Roaming certificate Digital certificate, which can be carried along as users move from one computer/
location to another.
RSA algorithm Asymmetric key algorithm, widely used for encryption and digital signatures.
Running Key Cipher Techique where some portion of text from a book is used as the key.
Secure Electronic Transaction (SET) Protocol developed jointly by MasterCard, Visa and many other
companies for secure credit card payments on the internet.
BALAGURUSxxii Important Terms and Abbreviations
Secure MIME (S/MIME) Protocol that adds security to the basic Multipurpose internet Mail Extensions
(MIME) protocol.
Secure Socket Layer (SSL) Protocol developed by Netscape communications for secure exchange of
information between a Web browser and a Web server over the internet.
Self-signed certlficat6 Digital certificate, wherein the subject name and the issuer name are the same, and is
signed by the issuer (which is also the subject). Usually the case only with CA certificates.
SHA Message digest algorithm, now preferred as the standard algorithm of choice.
Signed Java aPPlet Technology to make Java applets more trustworthy.
Simple Certificate Validation protocol (SCVP) Enhancement of the basic Online Certificate Status
Protocol (OCSP). Allows checks other than only the status of the certificate, unlike OCSP.
Simple Columnar Transposition Technique Variation of the basic transposition technique such as Rail
Fence Technique.
Simple Columnar Transposition Technique with multiple rounds Variation of Simple Columnar
Transposition Technique.
Single Sign On (SSO) Technology providing the users a single user id and password to access multiple
systems/applications.
Stl'eam cipher Technique encrypting one bit at a time.
Substitution Cipher Cryptographic technique involving the replacement of plain text characters with other
characters.
Symmetric Key Cryptography Cryptographic technique where the same key is used for encryption and
decryption operations.
Time StUmping Authority (TSA) Notary-like authority, which can vouch for the availability/creation of a
digital document at a particular point of time.
Time StUmping Protocol (TSP) Protocol using which a Time Stamping Authority (TSP) vouces for the
availability/creation of a digital document at a particular point of time.
Time-based token Type of authentication token.
Traffic analysis Mechanism whereby an attacker examines the packets moving across a network, and uses
this information to launch an attack.
Transport Layer Security (TLS) Protocol similar to SSL.
Transposition Cipher Cryptographic technique involving the re--arrangement of plain text characters in
some other form.
Triple DES Modified version of DES, involves 128--bit or 168--bit keys.
Trojan horse Small program that does not attempt to delete anything on the user's disk, but instead,
replicates itself on the computer/networks.
Trusted system Computer system that can be trusted to a certain extent in terms of implementing the
designated security policy.
Vernam Cipher See One--time pad.
Virtual Private Network (VPN) Technology that makes use of the existing internet as a private network,
using cryptographic techniques.
Virus Small program that causes harm to a user's computer and performs destructive activities.
Wireless Transport Layer Security (WTLS) Layer in WAP for facilitating secure communications between
a client and a server.
Worm Small program, which does not damage a computer/network, but consumes resources, slowing it
down considerably.
X.500 Standard name for the LDAP technology.
X.509 Format for digital certificate contents and structure.
XML digital signatures Technology that allows signing of specific portions of a message.
